BlackHat资料us-14-Jin-Smart-Nest-Thermostat-A-Smart-Spy-In-Your-Home.pdfVIP

Smart Nest Thermostat A Smart Spy in Your Home Grant Hernandez, Orlando Arias, Daniel Buentello, and Yier Jin Security in Silicon Laboratory, University of Central Florida Outline • IoT Era: Security and Privacy • IoT Star: Nest Thermostat • Nest Architecture – Firmware and Hardware • User Privacy • Hardware Backdoor • Demonstrations • Conclusions and Future Work Who We Are • Grant Hernandez: Computer Engineering UG, UCF • Orlando Arias: Computer Engineering UG, UCF • Daniel Buentello: Independent researcher • Yier Jin: Electrical Engineering, Ph.D. Introduction • Internet of Things – “When wireless is perfectly applied the whole earth will be converted into a huge brain...and the instruments through which we shall be able to do this will be amazingly simple compared with our present telephone. A man will be able to carry one in his vest pocket.” - Nikola Tesla 1926 • Definition – Embedded devices with networking capabilities. IoT and Wearable Devices Assorted images found online. IoT Forecast IoT Forecast Security and Privacy • Security Concerns – “ThingBot”: More than 750,000 phishing and SPAM emails launched from “ThingBots” including televisions, fridges – IOActive examined the WeMo “Light Switch” firmware and uncovered a series of issues • Privacy Concerns – Personal data is often collected without users’ awareness – The “big personal data” includes too much information IoT STAR: NEST THERMOSTAT Nest Thermostat • Nest Labs founded by Tony Fadell • Debuted in October 2011 • Acquired by Google in January 2014 ($3.2B) • Over 40,000 sold each month Data from GigaOM as of January 2013 • Available in UK in Ap